Update Fleet-maintained apps - #44564
Conversation
Generated automatically with cmd/maintained-apps.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Script Diff Resultsee/maintained-apps/outputs/microsoft-teams/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/rancher/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/teleport-connect/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/teleport-suite/darwin.json=== Install // 35762c86 -> 2c7e3ed1 ===
--- /tmp/old.1SB7DR 2026-05-01 02:14:33.994027244 +0000
+++ /tmp/new.OPExIA 2026-05-01 02:14:33.995027267 +0000
@@ -96,5 +96,5 @@
# install pkg files
quit_and_track_application 'com.gravitational.teleport.tsh'
-sudo installer -pkg "$TMPDIR/teleport-18.7.5.pkg" -target /
+sudo installer -pkg "$TMPDIR/teleport-18.7.6.pkg" -target /
relaunch_application 'com.gravitational.teleport.tsh'
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/zotero/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) === |
WalkthroughThis PR updates version metadata for five macOS applications in the maintained-apps outputs directory: Microsoft Teams (26072.608.4595.8484 to 26093.311.4599.3126), Rancher Desktop (1.22.0 to 1.22.1), Teleport Connect (to 18.7.6), Teleport Suite (18.7.5 to 18.7.6), and Zotero (9.0.1 to 9.0.2). Each update includes changes to version strings, patched query comparisons, installer URLs, and SHA256 checksums. The Teleport Suite update also includes a new install script reference. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
ee/maintained-apps/outputs/teleport-suite/darwin.json (1)
19-19: ⚡ Quick winAdd a guard for
INSTALLER_PATHto improve failure mode.The script computes
TMPDIRfrom$(realpath "$INSTALLER_PATH")and later relies onINSTALLER_PATHimplicitly. IfINSTALLER_PATHis missing/empty due to a harness change or download failure, the script will likely fail with confusing errors fromrealpath/dirname/installer.Add an explicit check early in the script and exit with a clear message.
🔧 Proposed change
APPDIR="/Applications/" +if [[ -z "${INSTALLER_PATH:-}" ]]; then + echo "INSTALLER_PATH is not set; cannot locate the installer package." + exit 1 +fi TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@ee/maintained-apps/outputs/teleport-suite/darwin.json` at line 19, The script uses INSTALLER_PATH to compute TMPDIR via realpath which will produce confusing errors if INSTALLER_PATH is empty or unset; add an explicit guard near the top (before TMPDIR is computed) that checks INSTALLER_PATH is non-empty, prints a clear error like "INSTALLER_PATH is not set or file does not exist" and exits non-zero; ensure the check validates the file exists (e.g., test -f "$INSTALLER_PATH") and references INSTALLER_PATH and TMPDIR so reviewers can find the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@ee/maintained-apps/outputs/rancher/darwin.json`:
- Line 9: The installer_url value for Rancher Desktop v1.22.1 is pointing to a
non-existent asset and must be corrected; open the Rancher Desktop v1.22.1
release page, identify the actual aarch64 DMG asset filename, and replace the
current installer_url string for "installer_url" with the exact GitHub release
download URL that matches that filename (keeping the same v1.22.1 tag and
architecture), then validate the URL returns HTTP 200.
- Line 7: The current queries.patched SQL can misreport when osquery's apps
table returns multiple rows per bundle_identifier; change the predicate to
deduplicate by taking the maximum bundle_short_version per bundle_identifier and
compare that aggregated value to '1.22.1'. Concretely, replace the subquery in
queries.patched with an aggregation such as selecting MAX(bundle_short_version)
for bundle_identifier = 'io.rancherdesktop.app' (e.g., using a derived table or
GROUP BY) and then use version_compare(max_version, '1.22.1') to decide
patched/unpatched so only the newest installed instance is evaluated.
In `@ee/maintained-apps/outputs/teleport-suite/darwin.json`:
- Line 19: The install script in refs["2c7e3ed1"] hard-codes the package
filename in the installer command; change the installer invocation (the install
step after quit_and_track_application and before relaunch_application) to use
the existing INSTALLER_PATH (or basename "$INSTALLER_PATH") instead of
"$TMPDIR/teleport-18.7.6.pkg" so the script installs whatever file the harness
staged regardless of filename.
- Line 19: The script in refs["2c7e3ed1"] uses bash-only features (e.g., [[ ]],
local, (( )), SECONDS) but declares #!/bin/sh; change the shebang to #!/bin/bash
so functions quit_and_track_application and relaunch_application run under bash
(update the very first line of the script to use /bin/bash).
---
Nitpick comments:
In `@ee/maintained-apps/outputs/teleport-suite/darwin.json`:
- Line 19: The script uses INSTALLER_PATH to compute TMPDIR via realpath which
will produce confusing errors if INSTALLER_PATH is empty or unset; add an
explicit guard near the top (before TMPDIR is computed) that checks
INSTALLER_PATH is non-empty, prints a clear error like "INSTALLER_PATH is not
set or file does not exist" and exits non-zero; ensure the check validates the
file exists (e.g., test -f "$INSTALLER_PATH") and references INSTALLER_PATH and
TMPDIR so reviewers can find the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 234e9fdf-fd38-4a6e-9f8f-be7333910375
📒 Files selected for processing (5)
ee/maintained-apps/outputs/microsoft-teams/darwin.jsonee/maintained-apps/outputs/rancher/darwin.jsonee/maintained-apps/outputs/teleport-connect/darwin.jsonee/maintained-apps/outputs/teleport-suite/darwin.jsonee/maintained-apps/outputs/zotero/darwin.json
| "queries": { | ||
| "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'io.rancherdesktop.app';", | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'io.rancherdesktop.app' AND version_compare(bundle_short_version, '1.22.0') < 0);" | ||
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'io.rancherdesktop.app' AND version_compare(bundle_short_version, '1.22.1') < 0);" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) Find implementation/usage of version_compare()"
rg -n "version_compare\s*\(" -S .
echo "2) Inspect schema / uniqueness assumptions for apps table keyed by bundle_identifier + host"
rg -n "CREATE TABLE.*apps|UNIQUE.*apps|bundle_identifier" -S .Repository: fleetdm/fleet
Length of output: 50370
🏁 Script executed:
# Find version_compare function definition/implementation
rg -A 10 "version_compare\s*[=:]|CREATE.*FUNCTION.*version_compare|FUNCTION.*version_compare" .Repository: fleetdm/fleet
Length of output: 39
🏁 Script executed:
# Find apps table schema definition
rg -B 2 -A 10 "CREATE TABLE\s+apps|apps\s*\(" . --type sqlRepository: fleetdm/fleet
Length of output: 39
🏁 Script executed:
# Search for documentation or comments about version_compare
rg -B 3 -A 3 "version_compare" . --type md --type txt | head -100Repository: fleetdm/fleet
Length of output: 8859
🏁 Script executed:
# Check for uniqueness constraints or indexes on apps.bundle_identifier
rg "bundle_identifier.*UNIQUE|UNIQUE.*bundle_identifier|PRIMARY KEY" . --type sqlRepository: fleetdm/fleet
Length of output: 15027
🏁 Script executed:
# Find the apps table schema definition specifically
rg -A 20 "CREATE TABLE.*\`?apps\`?" server/datastore/mysql/schema.sqlRepository: fleetdm/fleet
Length of output: 5320
🏁 Script executed:
# Check migrations for apps table
fd -e sql . server/datastore/mysql/migrations | xargs rg -l "CREATE TABLE.*apps"Repository: fleetdm/fleet
Length of output: 41
🌐 Web query:
osquery version_compare function semantics SQLite
💡 Result:
The osquery version_compare function is a custom SQLite scalar function that compares two version strings and returns -1 if the left is less than the right, 0 if equal, or 1 if greater. Syntax: version_compare(LEFT_VERSION, RIGHT_VERSION, [COMPARE_FLAVOR]) - LEFT_VERSION and RIGHT_VERSION are strings to compare. - COMPARE_FLAVOR is optional: 'ARCH', 'DPKG', or 'RHEL' for Linux package versioning schemes. Default is semantic versioning. Examples: - version_compare('1.0', '1.0') returns 0 - version_compare('4:1.1.0', '4:1.1.0-3', 'ARCH') returns 0 - version_compare('50.4.1b', '50.4.1c') returns -1 - version_compare('1:1.2.13-2', '4.2.1', 'ARCH') returns 1 It was added via PR #8168 (merged Dec 2023), implementing package-aware parsing (splitting on '.', grouping numerics/alphanumerics). There is also a 'VERSION' collation for use in ORDER BY or WHERE with >/< operators. This is an osquery extension to SQLite, registered via registerVersionExtensions, available in osquery shell/daemon.
Citations:
- 1: https://osquery.readthedocs.io/en/stable/introduction/sql/
- 2: Add version collate functions osquery/osquery#8168
- 3: Add a SQLite function for comparing version strings osquery/osquery#5196
🏁 Script executed:
# Search for osquery apps table documentation or handling in Fleet
rg -i "apps.*table|bundle_identifier.*multiple|osquery.*apps" docs/ --type md | head -50Repository: fleetdm/fleet
Length of output: 1080
🏁 Script executed:
# Look for any discussions about apps table uniqueness or deduplication
rg -A 5 -B 5 "apps.*WHERE.*bundle_identifier" server/ --type go | head -100Repository: fleetdm/fleet
Length of output: 8652
🌐 Web query:
osquery macOS apps table multiple rows same bundle_identifier
💡 Result:
osquery’s macOS apps table can show multiple rows for the same bundle_identifier when multiple app bundles with that identifier are found (or when the table ends up collecting the same app bundle via different paths, such as a symlinked .app vs the real .app). The table schema includes bundle_identifier as a CFBundleIdentifier value; and osquery enumerates apps by first using LaunchServices and then supplementing with directory scanning. How to query (examples) 1) List all rows (potentially multiple) for a bundle identifier: SELECT name, path, bundle_identifier, bundle_version FROM apps WHERE bundle_identifier = 'com.example.bundle'; 2) Count how many app rows match that bundle identifier: SELECT bundle_identifier, COUNT(*) AS row_count FROM apps WHERE bundle_identifier = 'com.example.bundle' GROUP BY bundle_identifier; Why duplicates happen - osquery collects candidate app bundles into a set of Info.plist paths, then parses each plist into rows, so if you have more than one distinct app bundle on disk sharing the same CFBundleIdentifier, you’ll get multiple rows. - Also, osquery explicitly “supplements LaunchServices with directory scanning” in its apps table implementation, to find apps missing from LaunchServices (e.g., due to stale registrations). This means you can end up with multiple Info.plist paths for the “same” logical app (for example: symlink path in /Applications plus real path in a subdirectory), producing multiple rows with the same bundle_identifier. What to do if you want to deduplicate results yourself - Deduplicate on the Info.plist path (or on a normalized/resolved path) rather than bundle_identifier. - If you want a per-bundle_identifier “best” row, you’ll need a deterministic rule (e.g., choose the shortest path, or prefer /Applications/.app over subdirectories), because osquery doesn’t guarantee uniqueness by bundle_identifier. If you tell me your exact osquery version and paste one or two sample rows (name/path/bundle_version), I can suggest a concrete SQL dedupe query that fits your situation.
Citations:
- 1: https://github.com/osquery/osquery/blob/master/specs/darwin/apps.table
- 2: https://github.com/osquery/osquery/blob/master/osquery/tables/system/darwin/apps.mm
- 3: osquery/osquery@fa7fa5f
- 4: osquery
appstable misses applications when LaunchServices has stale registrations osquery/osquery#8789 - 5: https://developer.apple.com/documentation/coreservices/1449290-lscopyapplicationurlsforbundleid
🏁 Script executed:
# Search for any Fleet guidance or acknowledgment about handling multiple app rows
rg -i "multiple.*app|dedup|distinct.*app|bundle_identifier.*multiple" docs/ server/ --type go --type md | grep -v test | head -30Repository: fleetdm/fleet
Length of output: 3965
🏁 Script executed:
# Check if there are any comments in patch_policy code about this concern
cat -n pkg/patch_policy/patch_policy.go | head -100Repository: fleetdm/fleet
Length of output: 3754
Clarify queries.patched handling of osquery apps table returning multiple versions (risk: false "unpatched" reports).
The version_compare() function semantics are correct—version_compare(bundle_short_version, '1.22.1') < 0 properly means "is this version older than 1.22.1". However, there is a substantive risk:
osquery's macOS apps table can return multiple rows per bundle_identifier (due to LaunchServices supplementation, symlinks, or multiple app bundles with the same identifier on disk). The query logic:
NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = '…' AND version_compare(bundle_short_version, '1.22.1') < 0)
will incorrectly report the app as "not patched" if any row has a version older than 1.22.1, even if another row exists with a newer version. This could cause hosts with multiple app instances to remain flagged as unpatched indefinitely.
Consider either:
- Deduplicating osquery results per bundle_identifier (e.g., selecting the max version), or
- Documenting this as a known limitation requiring users to ensure single-instance apps.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ee/maintained-apps/outputs/rancher/darwin.json` at line 7, The current
queries.patched SQL can misreport when osquery's apps table returns multiple
rows per bundle_identifier; change the predicate to deduplicate by taking the
maximum bundle_short_version per bundle_identifier and compare that aggregated
value to '1.22.1'. Concretely, replace the subquery in queries.patched with an
aggregation such as selecting MAX(bundle_short_version) for bundle_identifier =
'io.rancherdesktop.app' (e.g., using a derived table or GROUP BY) and then use
version_compare(max_version, '1.22.1') to decide patched/unpatched so only the
newest installed instance is evaluated.
| "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'io.rancherdesktop.app' AND version_compare(bundle_short_version, '1.22.1') < 0);" | ||
| }, | ||
| "installer_url": "https://github.com/rancher-sandbox/rancher-desktop/releases/download/v1.22.0/Rancher.Desktop-1.22.0.aarch64.dmg", | ||
| "installer_url": "https://github.com/rancher-sandbox/rancher-desktop/releases/download/v1.22.1/Rancher.Desktop-1.22.1.aarch64.dmg", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
URL="https://github.com/rancher-sandbox/rancher-desktop/releases/download/v1.22.1/Rancher.Desktop-1.22.1.aarch64.dmg"
echo "Checking URL resolves (HTTP status)"
curl -sS -o /dev/null -w "%{http_code}\n" -L "$URL"Repository: fleetdm/fleet
Length of output: 97
Fix the broken installer_url - returns HTTP 404.
The URL for the Rancher Desktop v1.22.1 aarch64 DMG currently resolves to a 404 error, indicating the asset does not exist at this location. Verify the correct asset filename on the Rancher Desktop releases page and update the URL accordingly to ensure downloads succeed.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ee/maintained-apps/outputs/rancher/darwin.json` at line 9, The installer_url
value for Rancher Desktop v1.22.1 is pointing to a non-existent asset and must
be corrected; open the Rancher Desktop v1.22.1 release page, identify the actual
aarch64 DMG asset filename, and replace the current installer_url string for
"installer_url" with the exact GitHub release download URL that matches that
filename (keeping the same v1.22.1 tag and architecture), then validate the URL
returns HTTP 200.
| ], | ||
| "refs": { | ||
| "35762c86": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.7.5.pkg\" -target /\nrelaunch_application 'com.gravitational.teleport.tsh'\n", | ||
| "2c7e3ed1": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.7.6.pkg\" -target /\nrelaunch_application 'com.gravitational.teleport.tsh'\n", |
There was a problem hiding this comment.
Avoid hard-coding the pkg filename in the install script.
In refs["2c7e3ed1"], the installer command uses a fixed filename:
sudo installer -pkg "$TMPDIR/teleport-18.7.6.pkg" -target /
That’s brittle if the harness downloads/stages the package to INSTALLER_PATH under a different filename (even if it’s the same content). Since the script already derives TMPDIR from "$INSTALLER_PATH", it’s safer to install exactly "$INSTALLER_PATH" (or at least "$INSTALLER_PATH"’s basename), avoiding any filename mismatch.
🔧 Proposed change
-quit_and_track_application 'com.gravitational.teleport.tsh'
-sudo installer -pkg "$TMPDIR/teleport-18.7.6.pkg" -target /
-relaunch_application 'com.gravitational.teleport.tsh'
+quit_and_track_application 'com.gravitational.teleport.tsh'
+sudo installer -pkg "$INSTALLER_PATH" -target /
+relaunch_application 'com.gravitational.teleport.tsh'🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ee/maintained-apps/outputs/teleport-suite/darwin.json` at line 19, The
install script in refs["2c7e3ed1"] hard-codes the package filename in the
installer command; change the installer invocation (the install step after
quit_and_track_application and before relaunch_application) to use the existing
INSTALLER_PATH (or basename "$INSTALLER_PATH") instead of
"$TMPDIR/teleport-18.7.6.pkg" so the script installs whatever file the harness
staged regardless of filename.
🧩 Analysis chain
🏁 Script executed:
# Find maintained-apps related files to understand the execution context
find . -type f -name "*.ts" -o -name "*.js" -o -name "*.go" -o -name "*.py" | head -20Repository: fleetdm/fleet
Length of output: 1097
🏁 Script executed:
# Search for how install_script_ref is executed
rg "install_script_ref" -A 5 -B 5 --max-count=20Repository: fleetdm/fleet
Length of output: 50370
🏁 Script executed:
# Look for maintained-apps installer implementation
find . -path "*maintained-apps*" -type f \( -name "*.ts" -o -name "*.js" -o -name "*.go" -o -name "*.py" \) | head -30Repository: fleetdm/fleet
Length of output: 2154
🏁 Script executed:
# Find where scripts are executed in the maintained apps infrastructure
cat -n ee/maintained-apps/maintained_apps.go | head -100Repository: fleetdm/fleet
Length of output: 3265
🏁 Script executed:
# Look at darwin validation code
cat -n cmd/maintained-apps/validate/darwin.goRepository: fleetdm/fleet
Length of output: 13702
🏁 Script executed:
# Check app commander for script execution
cat -n cmd/maintained-apps/validate/app_commander.go | head -150Repository: fleetdm/fleet
Length of output: 5398
🏁 Script executed:
find . -path "*/orbit/pkg/scripts*" -type f | head -20Repository: fleetdm/fleet
Length of output: 243
🏁 Script executed:
# Look at the scripts execution code
find . -name "*.go" -path "*/orbit/pkg/scripts*" -exec wc -l {} + | sort -nRepository: fleetdm/fleet
Length of output: 285
🏁 Script executed:
cat -n orbit/pkg/scripts/exec_nonwindows.goRepository: fleetdm/fleet
Length of output: 1782
🏁 Script executed:
cat -n orbit/pkg/scripts/scripts.go | head -80Repository: fleetdm/fleet
Length of output: 3077
🏁 Script executed:
# Find and read fleet.ValidateShebang implementation
rg -A 30 "func ValidateShebang" --type goRepository: fleetdm/fleet
Length of output: 1805
🏁 Script executed:
# Find the shebangInfo function to understand the logic
rg -B 5 -A 40 "func shebangInfo" --type goRepository: fleetdm/fleet
Length of output: 2703
🏁 Script executed:
# Continue reading the shebangInfo function to see the full logic
rg -A 100 "func shebangInfo" --type go | head -150Repository: fleetdm/fleet
Length of output: 5892
🏁 Script executed:
# Check what the actual behavior is on macOS - look for any tests or documentation
rg "bin/sh" --type go -B 2 -A 2 | head -50Repository: fleetdm/fleet
Length of output: 3249
🏁 Script executed:
# Check if there are comments about macOS /bin/sh behavior
rg "Catalina|zsh|/bin/sh" server/fleet/scripts.go -B 2 -A 2Repository: fleetdm/fleet
Length of output: 1956
Change shebang from #!/bin/sh to #!/bin/bash.
The install script in refs["2c7e3ed1"] declares #!/bin/sh but uses bash-specific syntax: [[ ... ]], local, (( ... )), and the SECONDS timing variable. When the script is executed with its declared shebang, it will run with /bin/sh (which is zsh on macOS Catalina and later), causing failures since zsh in sh-compatible mode does not support these bash features.
🔧 Proposed change
-#!/bin/sh\n\n# variables
+#!/bin/bash\n\n# variables📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "2c7e3ed1": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.7.6.pkg\" -target /\nrelaunch_application 'com.gravitational.teleport.tsh'\n", | |
| "2c7e3ed1": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# install pkg files\nquit_and_track_application 'com.gravitational.teleport.tsh'\nsudo installer -pkg \"$TMPDIR/teleport-18.7.6.pkg\" -target /\nrelaunch_application 'com.gravitational.teleport.tsh'\n", |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@ee/maintained-apps/outputs/teleport-suite/darwin.json` at line 19, The script
in refs["2c7e3ed1"] uses bash-only features (e.g., [[ ]], local, (( )), SECONDS)
but declares #!/bin/sh; change the shebang to #!/bin/bash so functions
quit_and_track_application and relaunch_application run under bash (update the
very first line of the script to use /bin/bash).
Script Diff Resultsee/maintained-apps/outputs/microsoft-teams/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/rancher/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/teleport-connect/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/teleport-suite/darwin.json=== Install // 35762c86 -> 2c7e3ed1 ===
--- /tmp/old.Du30nl 2026-05-01 14:20:01.186449541 +0000
+++ /tmp/new.rG36mV 2026-05-01 14:20:01.186449541 +0000
@@ -96,5 +96,5 @@
# install pkg files
quit_and_track_application 'com.gravitational.teleport.tsh'
-sudo installer -pkg "$TMPDIR/teleport-18.7.5.pkg" -target /
+sudo installer -pkg "$TMPDIR/teleport-18.7.6.pkg" -target /
relaunch_application 'com.gravitational.teleport.tsh'
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/zotero/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) === |
Script Diff Resultsee/maintained-apps/outputs/microsoft-teams/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/teleport-connect/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/teleport-suite/darwin.json=== Install // 35762c86 -> 2c7e3ed1 ===
--- /tmp/old.hHCpwO 2026-05-01 14:20:32.386016798 +0000
+++ /tmp/new.Jp42bT 2026-05-01 14:20:32.386016798 +0000
@@ -96,5 +96,5 @@
# install pkg files
quit_and_track_application 'com.gravitational.teleport.tsh'
-sudo installer -pkg "$TMPDIR/teleport-18.7.5.pkg" -target /
+sudo installer -pkg "$TMPDIR/teleport-18.7.6.pkg" -target /
relaunch_application 'com.gravitational.teleport.tsh'
=== Uninstall Script (no changes) ===ee/maintained-apps/outputs/zotero/darwin.json=== Install Script (no changes) ===
=== Uninstall Script (no changes) === |
|
Closing in favor of #44579. |
2 participants
Automated ingestion of latest Fleet-maintained app data.
Summary by CodeRabbit